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SUBJECT:  Audit  Report  on  Compilation  of  FY  1996  Air  Force  Consolidated  Financial 
Statements  at  the  Defense  Finance  and  Accounting  Service  Denver  Center 
(Report  No.  98-054) 


We  are  providing  this  audit  report  for  review  and  comments.  The  audit  was 
performed  in  response  to  the  Chief  Financial  Officers  Act  of  1990.  Management 
comments  on  a  draft  of  this  report  were  considered  in  preparing  the  final  report. 

DoD  Directive  7650.3  requires  that  all  recommendations  be  resolved  promptly. 
Comments  from  the  Defense  Finance  and  Accounting  Service  were  partially 
responsive.  We  request  that  the  Defense  Finance  and  Accounting  Service  provide 
additional  comments  on  Recommendation  l.a.(2)  by  March  24,  1998. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional 
information  on  this  report,  please  contact  Mr.  Richard  B.  Bird,  Audit  Program 
Director,  at  (703)  604-9175  (DSN  664-9175)  or  e-mail  RBird@dodig.osd.mil,  or 
Mr.  W.  Andy  Cooley,  Audit  Project  Manager,  at  (303)  676-7393  (DSN  926-7393)  or 
e-mail  ACooley@cleveland.dfas.mil.  Enclosure  D  lists  the  distribution  of  this  report. 
The  audit  team  members  are  listed  inside  the  back  cover. 


Robert  J.  Lieberman 
Assistant  Inspector  General 
for  Auditing 
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Executive  Summary 


Introduction.  The  Chief  Financial  Officers  Act  of  1990,  as  amended  by  the  Federal 
Financial  Management  Act  of  1994,  requires  the  Inspector  General,  DoD,  to  audit  the 
DoD  financial  statements.  We  delegated  the  audit  of  the  FY  1996  Air  Force 
Consolidated  Financial  Statements  to  the  Air  Force  Audit  Agency.  The  Defense 
Finance  and  Accounting  Service  (DFAS)  Denver  Center  maintained  accounting  records 
and  prepared  the  FY  1996  financial  statements  for  the  Air  Force.  More  than 
$342  billion  in  total  assets  was  reported  at  year’s  end  in  these  statements,  and  total 
revenues  for  the  year  exceeded  $59  billion.  The  Air  Force  Audit  Agency  disclaimed  an 
opinion  on  these  statements.  Our  audit  focused  on  the  Chief  Financial  Officers 
Reporting  System  used  by  the  DFAS  Denver  Center  to  compile  the  FY  1996  Air  Force 
financial  statements.  The  DFAS  Denver  Center  developed  the  Chief  Financial  Officers 
Reporting  System  at  a  cost  of  $586,750. 

Audit  Objectives.  The  primary  audit  objective  was  to  determine  whether  the  DFAS 
Denver  Center  consistently  and  accurately  compiled  financial  data  from  field  activities 
and  other  sources  for  the  FY  1996  Air  Force  financial  statements.  We  also  determined 
whether  FY  1996  ending  balances  reported  by  the  DFAS  Denver  Center  were 
supportable  for  use  as  beginning  balances  in  the  FY  1997  financial  statements.  In 
addition,  we  evaluated  the  DFAS  Denver  Center’s  compliance  with  applicable  laws  and 
regulations  and  its  internal  control  program  as  related  to  our  objectives. 

Audit  Results.  Although  significant  financial  management  challenges  remain,  the 
DFAS  Denver  Center  completed  corrective  actions  on  16  of  28  prior  recommendations 
made  by  the  Inspector  General,  DoD,  to  improve  the  process  of  compiling  the 
Air  Force  financial  statements.  See  Appendix  C,  Other  Matters  of  Interest,  for  details 
of  the  unresolved  recommendations. 

The  DFAS  Denver  Center  achieved  a  measure  of  success  in  using  the  Chief  Financial 
Officers  Reporting  System  to  expedite  the  accurate  and  consistent  preparation  of  the 
Air  Force  financial  statements.  However,  the  Chief  Financial  Officers  Reporting 
System  used  the  same  data  sources  as  the  manual  process  it  replaced.  Therefore, 
material  weaknesses  identified  in  prior  audits  still  limited  the  reliability  of  the  Air 
Force  financial  statements  for  FY  1996.  Additionally,  the  ending  balances  reported  in 


those  financial  statements  cannot  be  relied  on  as  beginning  balances  for  the  next  fiscal 
year.  The  Chief  Financial  Officers  Reporting  System  was  not  adequately  documented 
or  controlled,  and  the  DFAS  Denver  Center  had  not  adequately  planned  for  required 
programming  support.  Inadequate  system  documentation  and  control  may  adversely 
affect  the  future  operation  of  die  Chief  Financial  Officers  Reporting  System,  and 
significant  costs  will  be  incurred  to  develop  or  contract  for  programming  support 
required  for  system  maintenance.  See  Appendix  A  for  details  of  the  internal  control 
program. 

Summary  of  Recommendations.  We  recommend  that  the  Director,  DFAS  Denver 
Center,  improve  the  documentation  and  security  for  the  Chief  Financial  Officers 
Reporting  System  and  approve  future  plans  to  maintain  the  system. 

Management  Comments  and  Audit  Response.  We  issued  a  draft  of  this  report  on 
August  29,  1997,  and  received  comments  from  DFAS.  Management  concurred  with 
all  recommendations.  Management  agreed  to  improve  the  documentation  and  security 
for  the  Chief  Financial  Officers  Reporting  System  and  approve  future  plans  to  maintain 
the  system.  Management  designated  a  systems  administrator  to  annually  review  and 
report  on  access  controls  over  the  Chief  Financial  Officers  Reporting  System.  Except 
in  one  instance,  management  comments  were  fully  responsive.  Having  a  systems 
administrator  review  access  controls  annually  is  not  adequate.  System  access  should  be 
monitored  and  reviewed  periodically  throughout  the  year.  We  request  that  DFAS 
provide  additional  comments  by  March  24,  1998.  The  DFAS  Denver  Center’s 
comments  were  considered  in  preparing  the  final  report.  See  Part  I  for  a  discussion  of 
the  management  comments  and  Part  III  for  the  complete  text  of  the  comments. 
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Audit  Background 


Audit  Requirement.  Public  Law  101-576,  the  Chief  Financial  Officers  Act  of 
1990  (the  CFO  Act),  as  amended  by  the  Federal  Financial  Management  Act  of 
1994,  requires  the  Inspector  General  (IG),  DoD,  or  an  independent  auditor 
appointed  by  the  IG,  DoD,  to  audit  (he  financial  statements  of  DoD  reporting 
entities.  We  delegated  the  audit  of  the  FY  1996  Air  Force  Consolidated 
Financial  Statements  to  the  Air  Force  Audit  Agency  (AFAA).  The  Defense 
Finance  and  Accounting  Service  (DFAS)  Denver  Center  maintains  records  for 
the  Department  of  the  Air  Force  and  prepared  the  FY  1996  Air  Force  financial 
statements  from  data  submitted  by  the  Air  Force  and  other  DoD  organizations. 
More  than  $342  billion  in  total  assets  was  reported  at  year’s  end  in  these 
statements  and  total  revenues  for  the  year  exceeded  $59  billion.  AFAA 
disclaimed  an  opinion  on  the  FY  1996  statements.  We  reviewed  the 
compilation  of  the  financial  statements  at  the  DFAS  Denver  Center.  Our  audit 
focused  on  the  Chief  Financial  Officers  Reporting  System  (the  CFO  Reporting 
System)  used  by  the  DFAS  Denver  Center  to  compile  the  FY  1996  Air  Force 
financial  statements. 

CFO  Reporting  System.  In  1995,  the  DFAS  Denver  Center  established  the 
CFO  Act  Compliance  Program  Project,  under  which  the  CFO  Reporting  System 
was  developed.  The  project  was  established  to  find  a  better  method  of  meeting 
the  financial  reporting  requirements  of  the  DFAS  Denver  Center.  Before  the 
CFO  Reporting  System  was  used,  the  DFAS  Denver  Center  relied  on  a  manual 
process  to  prepare  the  Air  Force  financial  statements.  Budgetary  and  financial 
data  were  manually  extracted  from  a  variety  of  sources  and  were  then  manually 
summarized  in  a  spreadsheet.  The  spreadsheet  was  used  to  consolidate  the  data 
and  provide  the  financial  information  necessary  to  manually  produce  the  general 
ledger,  trial  balance,  and  financial  statements.  DFAS  Denver  Center  had  not 
documented  the  procedures  for  compiling  and  inputting  data  to  the  spreadsheet 
and  the  rationale  for  the  automated  spreadsheet  calculations.  Thus,  the  financial 
statements  were  subject  to  a  higher  risk  of  material  misstatements  because  of  the 
increased  potential  for  procedural  inconsistencies  and  human  error.  Among 
other  objectives,  the  CFO  Reporting  System  was  developed  to  document  and 
expedite  (through  automation)  the  process  used  by  the  DFAS  Denver  Center  to 
prepare  the  Air  Force  financial  statements.  The  DFAS  Denver  Center 
developed  the  CFO  Reporting  System  at  a  cost  of  $586,750. 

Supporting  Computer  Systems.  The  CFO  Reporting  System  relied  primarily 
on  data  from  external  sources  and  the  following  internal  computer  systems. 

o  The  Status  of  Funds  database,  which  is  part  of  the  Departmental  On- 
Line  Accounting  and  Reporting  System,  contains  budget  information 
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summarized  by  appropriation.  The  CFO  Reporting  System  automatically 
extracts  data  only  from  the  Status  of  Funds  database.  Payment  and  collection 
transactions  from  the  Merged  Accountability  and  Fund  Reporting  (MAFR) 
system  are  systematically  included  in  the  Status  of  Funds  database  at  the 
appropriation  level. 

o  The  Air  Force  General  Funds  General  Ledger,  which  provides  some 
accounting  information,  is  summarized  by  Air  Force  base  and  general  ledger 
account  code. 

The  DFAS  Denver  Center  has  little  control  over  some  of  the  data,  and  the 
reliability  of  much  of  the  data  cannot  be  confirmed  at  the  Air  Force  level.  For 
this  and  other  reasons,  the  AFAA  has  disclaimed  an  opinion  on  the  Air  Force 
Consolidated  Financial  Statements  for  FYs  1992  through  1996. 


Audit  Objectives 


The  primary  audit  objective  was  to  determine  whether  the  DFAS  Denver  Center 
consistently  and  accurately  compiled  financial  data  from  field  activities  and 
other  sources  for  the  FY  1996  Air  Force  Consolidated  Financial  Statements. 

We  also  determined  whether  the  FY  1996  ending  balances  reported  by  the 
DFAS  Denver  Center  were  supportable  for  use  as  beginning  balances  in  the 
FY  1997  financial  statements.  In  addition,  we  evaluated  the  DFAS  Denver 
Center’s  compliance  with  applicable  laws  and  regulations  and  its  internal  control 
program,  as  it  related  to  our  objectives.  See  Appendix  A  for  a  discussion  of  the 
scope  and  methodology  and  the  results  of  our  review  of  the  internal  control 
program.  See  Appendix  B  for  prior  audits  and  other  reviews  and  Appendix  C 
for  a  discussion  of  unresolved  issues  from  prior  audits. 
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Chief  Financial  Officers  Reporting 
System 

The  DFAS  Denver  Center  achieved  a  measure  of  success  in  expediting 
the  accurate  and  consistent  preparation  of  the  Air  Force  financial 
statements  utilizing  the  CFO  Reporting  System.  However,  the  CFO 
Reporting  System  used  the  same  data  sources  as  the  manual  process  it 
replaced.  Therefore,  material  weaknesses  identified  in  prior  audits  still 
limit  the  reliability  of  the  Air  Force  financial  statements.  As  a  result, 
users  of  the  financial  statements  could  not  rely  on  the  FY  1996 
Air  Force  financial  statements.  Additionally,  the  ending  balances 
reported  in  those  financial  statements  cannot  be  relied  on  as  beginning 
balances  for  the  next  fiscal  year. 

The  DFAS  Denver  Center  did  not  adequately  document  the  CFO 
Reporting  System  and  did  not  adequately  plan  for  system  security  and 
programming  support  required  to  maintain  the  system.  Specifically, 

o  the  design  and  operation  of  the  CFO  Reporting  System  were 
not  adequately  documented  during  system  development, 

o  access  to  the  CFO  Reporting  System  and  to  a  critical  system 
component  was  not  adequately  controlled,  and 

o  the  system  cannot  be  maintained  without  unique  programming 
support  or  extensive  reprogramming. 

The  CFO  Reporting  System  was  not  adequately  documented  because 
management  believed  that  on-line  help  screens  would  be  sufficient. 
Additionally,  a  key  manual  operating  procedure  was  not  documented 
because  management  did  not  consider  the  need  to  ensure  the  consistent 
application  of  the  procedure  in  the  future.  Finally,  provisions  for 
adequately  maintaining  and  providing  security  for  the  system  were  not 
made  because  the  time  and  materials  contract  did  not  specifically  require 
them.  Although  these  inadequacies  did  not  distort  the  data  on  the 
FY  1996  Air  Force  financial  statements,  correction  will  ensure  the 
consistent  application  of  system  procedures,  provide  the  necessary 
system  software  and  processing  integrity,  and  provide  for  the  future 
operation  of  the  CFO  Reporting  System. 
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Prior  Audit  Issues 


Key  Financial  Accounting  System  Issues.  As  detailed  in  Appendixes  B  and  C, 
financial  statements  prepared  using  the  CFO  Reporting  System  are  still  subject 
to  the  same  material  management  control  weaknesses  reported  in  prior  audits  by 
the  General  Accounting  Office  (GAO);  the  IG,  DoD;  and  the  AFAA.  One  of 
the  key  financial  accounting  system  issues  identified  in  these  prior  audits  is  the 
absence  of  a  transaction-driven  general  ledger  system  for  producing  the 
Air  Force  financial  statements. 

Issues  Identified  by  GAO.  The  GAO  first  identified  this  problem  in  a  1990 
report  on  the  FY  1988  Air  Force  financial  statements.  In  a  1992  followup 
audit,  GAO  reported  that  the  Air  Force  accounting  and  financial  management 
systems  were  still  not  integrated  under  a  transaction-driven  general  ledger. 

GAO  stated  that  consequently,  much  of  the  information  generated  by  the 
systems  was  inaccurate  and  unreliable. 

Issues  Identified  by  IG,  DoD.  In  this  audit  and  in  prior  reports,  the  IG,  DoD, 
also  noted  that  the  financial  information  reported  in  the  Air  Force  financial 
statements  for  FYs  1992  through  1996  was  not  derived  from  a  transaction- 
driven  general  ledger  system.  Instead,  the  financial  statements  were  prepared 
using  budgetary  and  other  data  from  the  Status  of  Funds  system  and  other 
sources.  Therefore,  the  Air  Force  financial  statements  were  not  reliable. 

Issues  Identified  by  AFAA.  The  AFAA  disclaimed  an  opinion  on  the 
Air  Force  financial  statements  for  FYs  1992  through  1996.  One  of  the  key 
reasons  cited  by  AFAA  for  its  disclaimers  was  that  the  financial  data  used  to 
develop  the  Air  Force  financial  statements  were  not  produced  by  a  transaction- 
driven  general  ledger,  and  existing  accounting  systems  could  not  produce 
auditable  financial  statements. 

Other  problems  exist  with  inadequate  automated  information  systems, 
reconciliation  and  resolution  of  U.S.  Treasury  clearing  accounts,  and  internal 
controls  over  the  MAFR  system  (see  Appendixes  B  and  C).  As  discussed 
below,  the  CFO  Reporting  System  was  not  intended  to  provide  transaction- 
driven  general  ledger  controls  or  resolve  other  problems  affecting  the 
auditability  and  reliability  of  the  Air  Force  financial  statements. 

CFO  Reporting  System  Issues.  The  CFO  Reporting  System  was  primarily 
developed  to  document  and  expedite  (through  automation)  the  undocumented 


*DFAS  is  developing  the  Defense  Joint  Accounting  System  (DJAS)  as  the 
migratory  system  for  fixture  financial  operations  at  die  DFAS  Denver  Center. 
However,  DJAS  will  not  be  operational  until  December  1999. 
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manual  procedures  used  by  the  DFAS  Denver  Center  in  preparing  the  Air  Force 
financial  statements.  It  serves  as  a  report  writer  that  compiles  budgetary  and 
financial  data  from  existing  sources,  regardless  of  any  problems  previously 
identified  in  these  sources  by  prior  audits.  Data  are  input  to  the  CFO  Reporting 
System  from  automated  and  manual  sources. 

o  The  CFO  Reporting  System  automatically  extracts  budgetary  data 
from  the  Air  Force  Status  of  Funds  system.  The  extract  is  reconciled  directly  to 
the  DD  Form  1176,  “Report  on  Budget  Execution,”  (the  DD  Form  1176  report) 
produced  by  the  Status  of  Funds  system.  Submitted  monthly  to  the 
U.S.  Treasury,  the  DD  Form  1176  report  summarizes  the  status  of  budgetary 
resources  and  related  financial  data. 

o  Most  dollar  values  used  by  the  CFO  Reporting  System  to  prepare  the 
Air  Force  financial  statements  are  still  derived  from  manual  inputs  of  journal 
vouchers  made  by  accounting  personnel  to  adjust  the  beginning  account 
balances.  In  absolute  values,  automated  inputs  represented  only  $187  billion  of 
the  $687  billion  in  combined  amounts  reported  for  assets,  liabilities,  and  net 
position  in  the  Air  Force  Statement  of  Financial  Position  as  of  September  30, 
1996. 

The  automated  extract  made  by  the  CFO  Reporting  System  converts  the  balance 
identifiers  used  in  budgetary  reporting  to  a  general  ledger  account,  based  on 
posting  rules  and  tables  established  in  a  critical  spreadsheet  integrated  into  the 
system.  Data  inputs  are  assigned  to  general  ledger  accounts  in  summary  values 
at  the  Department  of  the  Air  Force  level,  not  at  the  individual  transaction  level. 

Conclusion.  The  CFO  Reporting  System  did  not  substantially  improve  the 
process  of  preparing  the  Air  Force  financial  statements.  Rather,  it  automated 
some  manual  processes,  with  little  improvement  in  the  quality  of  data  reported. 
As  discussed  below,  the  system  achieved  only  limited  success  in  automating  and 
documenting  the  process  used  to  prepare  the  Air  Force  financial  statements. 
Problems  were  also  identified  in  system  security. 


System  Documentation 


GAO  Documentation  Requirement.  The  design  and  operation  of  the  CFO 
Reporting  System  was  not  adequately  documented.  Title  2  of  the  GAO  “Policy 
and  Procedures  Manual  for  Guidance  of  Federal  Agencies,”  August  1987, 
Appendix  III,  Chapter  5,  states: 

An  agency’s  accounting  system,  including  both  manual  and  automated 
components,  must  be  documented.  The  documentation  must  cover 
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(1)  the  system’s  development,  describing  the  baseline  of  the  system 
and  the  analysis  and  development  actions  undertaken,  and  (2)  the 
system’s  actual  operation,  describing  the  financial  management  and 
accounting  aspects,  how  the  functional  users  and  operators  interact 
with  and  use  the  system,  and  the  computer  program  narratives  and 
listings. 

The  documentation  must  be  complete,  current,  and  maintainable.  In 
addition,  it  must  be  of  sufficient  scope  and  depth  to  provide 
management,  users,  systems  operation  and  maintenance  personnel, 
and  auditors  and  other  evaluators  with  an  understanding  of  the  design 
and  operation  of  each  component  in  the  system  and  its  integration 
with  and  relation  to  all  other  components.  Documentation  of  the 
operational  accounting  system  must  be  appropriately  safeguarded  and 
must  be  periodically  updated  so  that  it  reflects  actual  operations. 

Prior  Issues.  The  DFAS  Denver  Center  has  experienced  problems  with 
undocumented  procedures  used  in  preparing  the  Air  Force  financial  statements. 
Correcting  these  documentation  problems  was  one  of  the  key  reasons  the  DFAS 
Denver  Center  established  the  CFO  Act  Compliance  Program  Project  in  1995. 
The  CFO  Reporting  System  was  developed  under  this  project.  Prior  to  the  CFO 
Reporting  System,  the  DFAS  Denver  Center  manually  summarized  data 
extracted  from  a  variety  of  sources  in  a  spreadsheet.  That  spreadsheet  was  used 
to  consolidate  the  data  and  provide  the  financial  information  necessary  to 
produce  the  general  ledger,  trial  balance,  and  financial  statements.  However, 
the  rationale  for  the  spreadsheet  inputs  and  calculations  was  not  documented. 
Required  knowledge  for  preparing  the  Air  Force  financial  statements  was  being 
lost  because  of  staff  turnover.  Thus,  the  financial  statements  were  subject  to  a 
higher  risk  of  material  misstatements  because  of  the  increased  potential  for 
procedural  inconsistencies  and  human  error.  The  CFO  Reporting  System  was 
developed  to  provide  an  automated  and  documented  system  for  preparing  the 
Air  Force  financial  statements. 

System  Documentation.  The  DFAS  Denver  Center  did  not  adequately 
document  the  design  and  operation  of  the  CFO  Reporting  System.  DFAS 
Denver  Center  personnel  intended  to  meet  these  requirements  by  including 
on-line  help  screens  in  the  system’s  design.  However,  these  help  screens 
provide  only  an  overview  of  each  major  system  function,  not  the  thorough 
understanding  of  the  system  that  is  required  to  answer  user  questions  or  resolve 
problems.  Because  of  inadequate  system  documentation,  the  contractor 
developing  the  CFO  Reporting  System  had  to  rehire  one  of  the  original 
programmers  to  make  system  changes  required  to  produce  the  FY  1996 
Air  Force  financial  statements.  Another  example  of  the  documentation 
problems  is  the  lack  of  documentation  for  reconciling  data  inputs  to  the  CFO 
Reporting  System. 
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Reconciliations  of  Imported  Data.  One  of  the  key  controls  included  in 
designing  the  CFO  Reporting  System  was  an  automated  reconciliation  of  the 
budgetary  data  imported  by  die  system  from  the  Status  of  Funds  system.  The 
CFO  Reporting  System  imported  budgetary  data  with  an  absolute  value  of 
$187  billion  from  the  Status  of  Funds  system  for  use  in  preparing  the  FY  1996 
Air  Force  financial  statements.  When  the  DFAS  Denver  Center  determined  that 
the  automated  reconciliation  had  not  worked  properly,  a  manual  reconciliation 
was  made  in  preparing  the  FY  1996  Air  Force  financial  statements.  The  CFO 
Reporting  System  automatically  imports  budgetary  data  from  the  Status  of 
Funds  system,  converting  the  balance  identifiers  used  in  budgetary  reports  to 
general  ledger  accounts.  An  automated  reconciliation  was  designed  to  verify 
that  the  data  imported  into  the  CFO  Reporting  System  equaled  control  figures 
on  the  DD  Form  1176  reports  produced  by  the  Status  of  Funds  system.  The 
automated  reconciliation  could  not  be  performed  because  the  DD  Form  1176 
report  contained  extraneous  data  related  to  canceled  accounts  that  were 
reestablished  by  the  U.S.  Treasury  for  processing  accounting  corrections.  The 
programming  for  the  automated  reconciliation  did  not  make  proper  adjustments 
for  this  extraneous  data. 

The  basis  for  making  the  manual  reconciliation  was  not  documented. 

Personnel  in  the  CFO  Branch,  DFAS  Denver  Center  Directorate  of 
Departmental  Accounting,  manually  reconciled  and  verified  the  accuracy  of  data 
imported  from  the  Status  of  Funds  system.  Because  the  rationale  and 
procedures  for  making  the  manual  reconciliation  were  not  documented,  future 
reconciliations  may  be  performed  inconsistently  or  not  at  all.  As  a  result, 
financial  data  from  different  reporting  periods  may  not  be  comparable,  thus 
seriously  degrading  the  ability  of  users  to  analyze  financial  data  from  more  than 
one  reporting  period. 

Conclusion.  The  lack  of  documentation  for  the  design  and  operation  of  the 
CFO  Reporting  System  perpetuates  the  high  risk  of  material  misstatements  in 
the  Air  Force  financial  statements  because  of  the  increased  potential  for 
procedural  inconsistencies  and  human  error. 


System  Security 


OMB  Security  Requirement.  User  access  to  the  CFO  Reporting  System  and  a 
critical  spreadsheet  used  by  the  system  were  not  adequately  controlled.  Office 
of  Management  and  Budget  (OMB)  Circular  No.  A- 130,  “Management  of 
Federal  Information  Resources,”  February  8,  1996,  Appendix  HI,  requires 
agencies  to  implement  and  maintain  a  program  to  assure  that  adequate  security 
is  provided  for  all  information  collected,  processed,  transmitted,  stored,  or 
disseminated  in  general  support  systems  and  major  applications.  DFAS 
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5200. 28-R,  “DFAS  Automated  Information  Systems  Security  Policy,” 
September  1993,  requires  that  passwords  be  changed  annually  and  be  at  least 
six  alphanumeric  characters  in  length.  The  CFO  Reporting  System  did  not  meet 
these  OMB  and  DFAS  requirements  in  establishing  system  passwords  or 
protecting  a  critical  spreadsheet. 

System  Passwords.  Contrary  to  DFAS  5200.28-R,  the  DFAS  Denver  Center 
did  not  design  the  CFO  Reporting  System  to  automatically  require  passwords  at 
least  six  alphanumeric  characters  in  length  or  enforce  requirements  for  annual 
changes  to  the  passwords.  Furthermore,  to  gain  quicker  access  to  the  system, 
authorized  users  could  delete  their  passwords  altogether  and  still  obtain  access  to 
the  CFO  Reporting  System.  When  users  deleted  their  passwords,  other 
authorized  users  could  access  the  CFO  Reporting  System  under  the  first  user’s 
identity  and  access  capability.  When  a  user  signs  on  to  the  CFO  Reporting 
System,  a  list  of  authorized  users  appears.  Authorized  users  highlight  their  own 
names,  enter  their  passwords,  and  are  given  access  to  the  system.  If  a  user 
deletes  his  or  her  password,  other  authorized  users  can  access  the  system  by 
highlighting  the  first  user’s  name.  As  discussed  below,  deleting  these  system 
passwords  also  increased  the  risk  that  unauthorized  individuals  might  gain 
access  to  the  CFO  Reporting  System  under  another  user’s  identity  by  using  the 
unprotected  computers  of  authorized  users. 

A  compensating  control  would  not  have  substituted  for  system  passwords,  but 
could  have  reduced  the  risk  of  unauthorized  access  to  the  computers  assigned  to 
authorized  users.  Access  to  the  CFO  Reporting  System  is  available  to 
authorized  users  through  Microsoft  Windows  on  the  DFAS  Enterprise  Local 
Area  Network.  Microsoft  Windows  allows  users  to  establish  screen  saver 
passwords  that  are  automatically  activated  whenever  the  computer  is  idle  for  a 
specified  time  interval.  To  be  an  effective  control  when  someone  is  temporarily 
absent  from  their  work  stations,  the  time  interval  should  be  relatively  short. 
When  combined  with  the  access  controls  on  the  DFAS  Enterprise  Local  Area 
Network,  this  screen  saver  password  helps  reduce  the  risk  that  unauthorized 
individuals  may  gain  access  to  the  CFO  Reporting  System  when  authorized 
users  are  temporarily  absent  from  their  workstations. 

Out  of  16  authorized  users,  10  were  reviewed,  and  only  1  had  established  a 
screen  saver  password.  However,  the  10-minute  time  interval  set  by  this  user 
was  too  long  to  be  an  effective  control.  Because  of  the  inadequate  password 
controls,  the  CFO  Reporting  System  was  exposed  to  unauthorized  change. 
During  the  audit,  but  before  the  statements  were  prepared,  authorized  users  with 
previously  deleted  system  passwords  had  reestablished  and  maintained  their 
passwords.  However,  passwords  used  by  5  of  16  authorized  users  did  not  meet 
the  minimum  length  requirements  of  DFAS  5200.28-R.  Our  review  did  not 
disclose  any  distortion  of  financial  data  caused  by  unauthorized  access  to  the 
CFO  Reporting  System. 
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Excel  Spreadsheet.  The  design  of  the  CFO  Reporting  System  incorporates  an 
Excel  spreadsheet  that  is  critical  to  the  system’s  operation.  That  spreadsheet 
contains  about  12,000  rules  and  tables  used  in  importing  data  from  the  Status  of 
Funds  system  to  the  CFO  Reporting  System.  Among  other  uses,  these  rules  and 
tables  establish  the  basis  for  converting  the  balance  identifiers  used  in  budgetary 
reporting  to  general  ledger  accounts,  and  specify  mathematical  formulas  for 
allocating  costs  only  during  the  importing  of  data  from  the  Status  of  Funds 
system  database.  By  signing  on  to  the  CFO  Reporting  System,  any  authorized 
user  had  full  access  to  the  spreadsheet.  Thus,  authorized  users  could 
deliberately  or  accidentally  add,  edit,  or  delete  any  or  all  of  the  rules  and  tables 
used  by  the  spreadsheet.  DFAS  Denver  Center  personnel  stated  that  such 
access  was  granted  to  allow  contracting  personnel  to  make  changes  and 
enhancements  during  system  development.  However,  allowing  such 
unrestricted  access  to  all  authorized  users  made  it  possible  for  them  to  corrupt 
or  change  the  spreadsheet  without  detection.  A  material  corruption  of  the 
spreadsheet  could  cause  significant  harm  to  the  spreadsheet  if  undetected  before 
making  periodic  system  backups.  The  data  reconciliation  previously  discussed, 
when  adequately  performed,  will  detect  any  distortion  of  data  caused  by 
corruption  of  the  spreadsheet.  However,  a  material  corruption  of  the 
spreadsheet  would  delay  processing  and  cause  the  DFAS  Denver  Center  to 
spend  extra  funds  to  restore  the  spreadsheet. 

Conclusion.  Inadequate  security  over  the  CFO  Reporting  System  jeopardizes 
the  integrity  of  system  software  and  processing.  Although  data  on  the  FY  1996 
Air  Force  financial  statements  were  not  distorted,  future  statements  produced  by 
the  CFO  Reporting  System  may  not  be  reliable  because  of  the  lack  of  system 
integrity.  Any  corruption  of  the  Excel  spreadsheet  would  be  detected  by  the 
data  reconciliation. 


System  Maintainability 


System  Development.  The  DFAS  Denver  Center  did  not  adequately  plan  for 
the  programming  support  required  to  maintain  the  CFO  Reporting  System.  On 
May  8,  1997,  after  the  DFAS  Denver  Center  had  incurred  costs  of  $586,750, 
the  contract  for  developing  the  CFO  Reporting  System  expired  with  no  contract 
or  other  means  in  place  for  providing  the  required  programming  support.  The 
CFO  Reporting  System  cannot  be  maintained  without  unique  programming 
support  or  extensive  reprogramming.  In  contracting  for  system  development, 
DFAS  Denver  Center  management  approved  the  use  of  a  commercial  software 
product,  Visual  FoxPro  3.0.  DFAS  Denver  Center  management  made  that 
decision  knowing  it  would  preclude  routine  software  support  from  the  DFAS 
Financial  System  Activity  Denver,  Financial  Services  Organization.  DFAS 
software  standards  established  later  did  not  include  Visual  FoxPro  3.0; 
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therefore,  internal  programming  support  is  still  not  available  within  DFAS. 
Therefore,  to  maintain  the  CFO  Reporting  System,  the  DFAS  Denver  Center 
will  incur  additional  costs  to  develop  internally  or  contract  for  nonstandard 
programming  support,  or  to  reprogram  the  system  in  one  of  the  DFAS  software 
standards.  When  the  development  contract  expired,  the  DFAS  Denver  Center 
had  no  estimate  of  the  additional  programming  costs  required  to  maintain  the 
CFO  Reporting  System. 

FY  1996  Financial  Statements.  In  preparing  the  FY  1996  Air  Force  financial 
statements,  the  contractor  employee  who  originally  programmed  the  CFO 
Reporting  System  was  rehired  to  correct  deficiencies  and  develop  programs  to 
allow  the  system  to  function  properly.  Accounting  personnel  at  the  DFAS 
Denver  Center  and  contractor  programmers  had  unsuccessfully  tried  to  operate 
the  CFO  Reporting  System  on  their  own.  However,  the  lack  of  adequate 
system  documentation  severely  hampered  the  contractor  programmers  in  their 
efforts  to  make  programming  changes.  The  original  programmer  was  rehired 
because  the  delays  encountered  had  jeopardized  the  timely  production  of  the 
Air  Force  financial  statements. 

Future  Financial  Statements.  Financial  reporting  requirements  for  FY  1997 
are  comparable  to  the  FY  1996  reporting  requirements.  However,  beginning 
October  1,  1997,  significant  changes  will  be  required  in  the  format  and  content 
of  FY  1998  financial  statements  submitted  for  the  Air  Force  and  other  Federal 
reporting  entities.  These  changes  are  dictated  by  financial  accounting  standards 
issued  by  the  Financial  Accounting  Standards  Advisory  Board.  To  meet  these 
new  reporting  requirements,  the  DFAS  Denver  Center  will  need  to  significantly 
reprogram  the  CFO  Reporting  System.  In  planning  such  system  changes, 

DFAS  Denver  Center  managers  will  also  need  to  weigh  the  costs  and  benefits  of 
converting  the  system  programming  to  the  DFAS  standard  software. 

Conclusion.  As  noted  in  discussing  the  Scope  and  Methodology  in 
Appendix  A,  this  audit  did  not  evaluate  the  procedures  followed  by  the  DFAS 
Denver  Center  in  contracting  for  the  development  of  the  CFO  Reporting 
System.  These  contracting  procedures  were  being  evaluated  in  a  Defense 
Hotline  audit.  However,  the  lapse  in  programming  support  for  the  CFO 
Reporting  System  indicates  that  during  system  development,  DFAS  Denver 
Center  managers  did  not  adequately  plan  for  continued  system  maintenance. 

The  absence  of  required  programming  support  jeopardized  the  future  operation 
of  the  CFO  Reporting  System.  Although  corrective  actions  are  now  in  process, 
the  Director,  DFAS  Denver  Center,  should  oversee  plans  for  maintaining  the 
CFO  Reporting  System. 
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Summary 


The  CFO  Reporting  System  achieved  a  measure  of  success  in  expediting  the 
accurate  and  consistent  application  of  procedures  (though  undocumented)  used 
by  the  DFAS  Denver  Center  in  preparing  the  Air  Force  financial  statements. 
However,  the  gains  achieved  are  diminished  by  material  weaknesses  in  system 
documentation,  security,  and  maintainability.  Also,  the  financial  statements 
produced  by  the  CFO  Reporting  System  continue  to  be  unreliable  because  of 
problems  with  the  computer  systems  as  identified  in  prior  audits,  and  problems 
with  data  used  by  the  CFO  Reporting  System.  The  CFO  Reporting  System 
will  be  replaced  by  the  Defense  Joint  Accounting  System  (DJAS),  currently 
under  development  by  DFAS.  For  these  reasons,  we  question  the  value  of  any 
extensive  development  efforts  to  correct  the  problems  identified  by  this  audit  in 
the  CFO  Reporting  System.  Therefore,  we  are  making  limited 
recommendations  to  correct  these  problems. 


Recommendations,  Management  Comments,  and  Audit 
Response 

1.  We  recommend  that  the  Director,  Directorate  of  Departmental 
Accounting,  Defense  Finance  and  Accounting  Service  Denver  Center: 

a.  Direct  the  Chief,  Chief  Financial  Officers  Branch, 
Directorate  of  Departmental  Accounting,  to: 

(1)  Document  the  procedures  used  to  manually 
reconcile  the  data  imported  into  the  Chief  Financial  Officers  Reporting 
System  from  the  DD  Form  1176,  “Report  on  Budget  Execution,”  produced 
by  the  Status  of  Funds  system. 

Management  Comments.  DFAS  concurred,  stating  that  the  process  was 
documented  in  a  Branch  Operating  Instruction  issued  in  June  1997. 

(2)  Periodically  monitor  access  controls  over  the  Chief 
Financial  Officers  Reporting  System  and  provide  annual  written  reports  on 
compliance  with  Recommendations  l.b.(l)  and  (2)  below. 

Management  Comments.  DFAS  concurred,  stating  that  a  system  administrator 
has  been  designated  to  review  and  control  access  to  the  CFO  Reporting  System 
and  produce  an  annual  report  for  management’s  use.  The  DFAS  stated  that  all 
actions  would  be  completed  by  June  1998. 
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Audit  Response.  Although  DFAS  concurred,  we  do  not  consider  its  comments 
responsive.  Because  the  CFO  Reporting  System  is  used  for  various  purposes 
throughout  the  year,  system  access  should  be  monitored  periodically  throughout 
the  year,  not  annually  as  proposed  by  management.  Requiring  annual  written 
reports  on  these  periodic  reviews  should  allow  management  to  evaluate  the 
adequacy  of  the  reviews.  We  request  that  DFAS  reconsider  its  position  on 
Recommendation  l.a.(2)  and  provide  additional  comments  in  response  to  the 
final  report. 

b.  Direct  all  authorized  users  of  the  Chief  Financial  Officers 
Reporting  System  to  establish: 

(1)  Passwords  of  at  least  six  alphanumeric  characters 
for  obtaining  access  to  the  Chief  Financial  Officers  Reporting  System. 

(2)  Screen  saver  password  controls  in  Microsoft 

Windows. 

Management  Comments.  DFAS  concurred,  stating  that  all  users  of  the  CFO 
Reporting  System  now  have  screen  savers  with  password  controls  and  are 
required  to  establish  passwords  of  at  least  six  alphanumeric  characters. 
Corrective  actions  were  completed  in  December  1996. 

2.  We  recommend  that  the  Director,  Defense  Finance  and 
Accounting  Service  Denver  Center,  review  and  approve  future  plans  for 
maintaining  the  Chief  Financial  Officers  Reporting  System. 

Management  Comments.  DFAS  concurred,  stating  that  the  Director,  DFAS 
Denver  Center,  will  review  and  approve  all  future  plans  for  maintaining  the 
CFO  Reporting  System.  Corrective  action  was  completed  in  October  1997. 
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Part  II  -  Additional  Information 


Appendix  A.  Audit  Process 


Scope  and  Methodology 


We  reviewed  the  process  used  by  the  DFAS  Denver  Center  to  compile  financial 
data  from  Air  Force  field  activities  and  other  sources  for  inclusion  in  the 
FY  1996  Air  Force  Consolidated  Financial  Statements.  Our  audit  focused  on 
the  CFO  Reporting  System  used  by  the  DFAS  Denver  Center  to  compile  the 
FY  1996  Air  Force  financial  statements.  To  assess  compliance  with  OMB 
guidance,  GAO  standards,  and  DoD  accounting  policies,  we  reviewed  systems 
and  operational  documentation  supporting  the  processing  of  financial 
transactions  within  the  CFO  Reporting  System.  Those  documents  included 
contract  deliverables  and  on-line  documentation  within  the  system.  We  also 
reviewed  passwords  used  to  control  access  to  the  CFO  Reporting  System.  In 
addition,  we  identified  recommendations  from  prior  IG,  DoD,  audits  at  the 
DFAS  Denver  Center  that  affected  the  compilation  of  data  for  the  FY  1996 
financial  statements. 

Limitations  to  Scope.  The  scope  of  this  audit  was  limited  in  the  following 
respects. 

Auditor  Opinion.  The  objective  of  our  audit  was  to  evaluate  whether 
the  DFAS  Denver  Center  fulfilled  its  responsibilities  for  preparing  the 
Air  Force  financial  statements.  Accordingly,  we  did  not  render  an  opinion  of 
the  financial  statements.  AFAA  issued  a  disclaimer  of  opinion  on  the  Air  Force 
financial  statements  in  its  Report  No.  96053001,  “Opinion  on  Fiscal  Year  1996 
Air  Force  Consolidated  Financial  Statements,”  March  1,  1997.  We  did  not 
evaluate  the  accuracy  of  data  provided  by  Air  Force  field  activities.  The  AFAA 
included  this  evaluation  in  its  review. 

Other  Financial  Statements.  We  did  not  evaluate  the  CFO  Reporting 
System’s  compilation  procedures  used  by  the  DFAS  Denver  Center  to  prepare 
the  Air  Force  Defense  Business  Operations  Fund  Consolidated  Financial 
Statements  for  FY  1996.  However,  the  system  documentation,  security,  and 
maintainability  problems  discussed  in  Part  I  affect  other  financial  statements 
prepared  using  the  CFO  Reporting  System. 

System  Development.  The  scope  of  this  audit  did  not  include 
evaluating  the  procedures  followed  by  the  DFAS  Denver  Center  in  contracting 
for  the  development  of  the  CFO  Reporting  System.  Those  and  other  DFAS 
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contracting  functions  are  being  evaluated  under  ongoing  IG,  DoD,  Project  No. 
7CK-8009,  “Audit  of  DoD  Hotline  Allegation  on  Contracting  for  Defense 
Finance  and  Accounting  Service  Support.  ” 

Use  of  Computer-Processed  Data.  To  achieve  the  audit  objectives,  we  relied 
extensively  on  computer-processed  data  in  the  CFO  Reporting  System.  Our 
review  of  system  controls  raised  questions  about  data  validity.  The  DFAS 
Denver  Center  has  initiated  corrective  actions  by  contracting  for  the  DJAS, 
which  is  scheduled  to  use  a  transaction-driven  general  ledger  system.  DFAS 
Denver  Center  management  expects  the  DJAS  to  be  completed  in 
December  1999. 

Audit  Period,  Standards,  and  Locations.  We  performed  this  financial- 
related  audit  from  May  1996  through  April  1997  in  accordance  with  auditing 
standards  issued  by  the  Comptroller  General  of  the  United  States,  as 
implemented  by  the  IG,  DoD.  We  included  tests  of  management  controls 
considered  necessary. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  the  DoD.  Further  details  are  available  on  request. 


Management  Control  Program  Review 


DoD  Directive  5010.38,  “Internal  Management  Control  Program,” 

April  14,  1987,*  requires  DoD  organizations  to  implement  a  comprehensive 
system  of  management  controls  that  provides  reasonable  assurance  that 
programs  are  operating  as  intended  and  to  evaluate  the  adequacy  of  the  controls. 

Scope  of  Review  of  Management  Control  Program.  We  reviewed  the 
adequacy  of  the  management  controls  over  the  preparation  of  financial 
statements  and  the  DFAS  Denver  Center’s  self-evaluation  of  those  controls. 
Specifically,  we  reviewed  the  management  controls  over  the  CFO  Reporting 
System  to  determine  whether  the  system  was  complete  and  auditable  and 
whether  adequate  documentation  existed  to  ensure  data  integrity. 

Adequacy  of  Management  Controls.  We  identified  material  management 
control  weaknesses  at  DFAS,  as  defined  by  DoD  Directive  5010.38. 
Documentation,  security,  and  maintainability  for  the  CFO  Reporting  System 
were  not  adequate  to  ensure  the  consistent  application  of  system  procedures, 


’DoD  Directive  5010.38  has  been  revised  as  “Management  Control  Program,” 
August  26,  1996.  The  audit  was  performed  under  the  April  1987  version  of  the 
directive. 
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provide  the  necessary  integrity  for  the  system  software  and  processing,  and 
provide  for  the  future  operation  of  the  system.  The  weaknesses  did  not  affect 
the  compilation  of  the  FY  1996  Air  Force  financial  statements,  but  may  affect 
future  statements.  Implementing  Recommendations  l.a.(l),  l.a.(2),  l.b.(l), 
and  l.b.(2)  will  improve  management  controls  over  system  documentation  and 
security,  but  will  not  correct  the  material  weaknesses  identified  in  prior  audits. 
For  the  reasons  given  in  the  summary  of  our  finding,  we  made  only  limited 
recommendations  to  correct  the  weaknesses  identified  by  the  audit. 
Implementing  Recommendation  2. ,  for  increased  management  oversight  of 
future  plans  to  maintain  the  CFO  Reporting  System,  should  ensure  adequate 
planning.  A  copy  of  the  report  will  be  provided  to  the  senior  DFAS  official 
responsible  for  management  controls. 

Adequacy  of  Management’s  Self-Evaluation.  DFAS  Denver  Center  officials 
identified  the  operations  in  the  CFO  Reporting  System  as  a  part  of  the  Status  of 
Appropriations  assessable  unit.  However,  the  officials  had  not  performed  a  risk 
assessment  since  the  implementation  of  the  CFO  Reporting  System;  therefore, 
the  risk  assessment  was  based  on  outdated  systems  information.  DFAS  Denver 
Center  officials  plan  to  perform  a  risk  assessment  by  FY  1998.  Because 
officials  responsible  for  the  Status  of  Appropriations  assessable  unit  had  not 
performed  an  assessment  recently,  they  did  not  identify  or  report  the  material 
management  control  weaknesses  identified  by  the  audit. 
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The  GAO;  the  IG,  DoD;  and  the  AFAA  have  issued  numerous  reports  that 
identified  weaknesses  in  the  internal  controls  over  the  compilation  of  data  used 
in  the  Air  Force  financial  statements.  Although  not  previously  audited,  the  new 
CFO  Reporting  System  is  affected  by  the  issues  reported  in  these  prior  audits, 
discussed  below  and  in  Appendix  C. 


General  Accounting  Office 


Report  No.  AFMD-92-12  (OSD  Case  No.  8376-L),  “Aggressive  Actions 
Needed  for  Air  Force  to  Meet  Objectives  of  the  CFO  Act,” 

February  19,  1992.  This  report  discussed  the  progress  made  by  DoD  and  the 
Air  Force  in  implementing  the  recommendations  made  by  GAO  in  its  audit  of 
the  FY  1988  Air  Force  financial  statements.  The  principal  findings  were  that 
financial  systems  were  not  integrated  and  generated  unreliable  information,  the 
reported  costs  of  weapon  systems  were  unreliable,  accounting  and  controls  over 
Air  Logistics  Command  inventories  were  inadequate,  internal  accounting 
controls  were  not  adequate,  and  short-term  actions  were  needed  to  improve  the 
quality  of  financial  data  and  to  ensure  the  completion  of  a  financial  statement 
audit.  GAO  reaffirmed  all  26  recommendations  included  in  its  prior  report 
(discussed  below)  and  made  additional  recommendations  to  improve 
management’s  accountability,  internal  controls,  and  the  quality  of  financial 
information,  and  to  assist  the  Air  Force  in  meeting  the  objectives  of  the  CFO 
Act.  The  DoD  Comptroller  (now  the  Under  Secretary  of  Defense 
[Comptroller])  generally  concurred  with  all  recommendations  made  in  this 
report. 

Report  No.  AFMD-90-23  (OSD  Case  No.  8193-A),  “Air  Force  Does  Not 
Effectively  Account  for  Billions  of  Dollars  of  Resources,” 

February  23,  1990.  This  audit  focused  on  the  GAO  review  of  the  accounts 
contained  in  the  FY  1988  Air  Force  financial  statements.  The  principal  findings 
were  that  financial  systems  did  not  provide  reliable  financial  data,  basic  internal 
control  weaknesses  existed,  the  full  costs  of  weapon  systems  were  not 
identified,  and  inventory  systems  did  not  provide  accurate  data.  The  DoD 
Comptroller  (now  the  Under  Secretary  of  Defense  [Comptroller])  concurred 
with  all  26  recommendations  in  the  report.  Recommendations  were  made  to  use 
existing  financial  information  and  develop  more  accurate  financial  information, 
perform  reconciliations  and  document  adjustments,  account  for  the  costs  of 
weapon  systems,  achieve  financial  management  of  inventories,  and  develop  a 
new  accounting  system. 
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Inspector  General,  DoD 


Report  No.  97-057,  “Compilation  of  FY  1995  Air  Force  Consolidated 
Financial  Statements  at  the  Defense  Finance  and  Accounting  Service 
Denver  Center,”  December  27,  1996.  This  report  stated  that  the  DFAS 
Denver  Center  did  not  provide  sufficient  evidence  that  it  had  accurately 
compiled  financial  data  from  field  organizations  and  other  sources  for  the 
FY  1995  Air  Force  Consolidated  Financial  Statements.  The  report  had  two 
findings. 

o  The  DFAS  Denver  Center  did  not  report  negative  accounts  payable  of 
$882.3  million  and  did  not  disclose  the  use  of  unreliable  data  in  preparing  the 
financial  statements.  As  a  result,  we  could  not  confirm  the  reliability  of 
$4  billion  in  accounts  payable  to  non-Federal  entities,  as  reported  in  the 
financial  statements.  In  addition,  users  of  the  financial  statements  were  not 
aware  that  they  could  not  rely  on  the  accuracy  of  reported  accounts  payable 
transactions. 

o  The  Command  On-Line  Accounting  and  Reporting  System,  a  major 
source  of  data  for  financial  reports,  did  not  provide  adequate  audit  trails  for 
verifying  adjustments  made  by  the  DFAS  Denver  Center.  Therefore,  DFAS 
Denver  Center  managers  did  not  have  reasonable  assurance  that  all  adjustments 
were  adequately  supported,  classified,  coded,  and  recorded. 

Management  concurred  with  the  recommendations  made  in  this  report. 
Recommendations  were  made  to  establish  milestones  for  and  monitor  the 
progress  of  changes  in  the  automated  information  system  for  reporting  accounts 
payable;  to  provide  accounting  personnel  with  guidance  on  financial  statement 
disclosures;  and  to  establish  a  complete  and  accurate  audit  trail  of  all 
adjustments  made  by  DFAS  Denver  Center  personnel  in  the  Command  On-Line 
Accounting  and  Reporting  System  until  the  development  of  DJAS  is  completed. 

Report  No.  95-301,  “Major  Deficiencies  Preventing  Auditors  From 
Rendering  Audit  Opinions  on  DoD  General  Fund  Financial  Statements,” 
August  29,  1995.  This  report  summarized  the  major  deficiencies  impeding  the 
ability  of  DoD  to  produce  auditable  financial  statements.  Four  major 
deficiencies  prevented  auditors  from  rendering  opinions  on  Army  and  Air  Force 
General  Fund  financial  statements. 

o  Accounting  systems  supporting  DoD  General  Funds  did  not  have  an 
integrated,  double-entry,  transaction-driven  general  ledger  to  compile  and  report 
reliable  and  auditable  information. 

o  Material  deficiencies  existed  in  reporting  $612.9  billion  of  assets  on 
the  FY  1994  Statements  of  Financial  Position. 
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o  Auditors  could  not  determine  the  reasonableness  and  accuracy  of 
various  accounts  because  the  amounts  were  derived  from  unreliable 
disbursement  and  collection  data. 

o  Auditors  could  not  determine  the  reasonableness  of  the  amounts  or 
disclosures  made  related  to  contingent  liabilities  that  should  have  been 
recognized  as  liabilities  on  the  FYs  1993  and  1994  Statements  of  Financial 
Position. 

The  report  also  summarized  the  actions  taken  or  under  way  to  correct  these 
deficiencies.  The  report  contained  no  recommendations.  Management  did  not 
disagree  with  any  facts  or  conclusions  in  the  report. 

Report  No.  95-264,  “Defense  Finance  and  Accounting  Service  Work  on  the 
Air  Force  FY  1994  Financial  Statements,”  June  29,  1995.  This  report 
identified  material  weaknesses  in  the  security  oversight  provided  by  the  DFAS 
Denver  Center  to  the  MAFR  system  and  in  the  system’s  audit  trail  for  entries 
made  at  the  DFAS  Denver  Center.  The  report  contained  no  recommendations 
because  management  had  already  initiated  corrective  actions  to  improve  security 
and  establish  required  audit  trails  in  the  Defense  Cash  Management  System, 
which  will  replace  the  MAFR  system. 

Report  No.  95-067,  “Defense  Finance  and  Accounting  Service  Work  on  the 
Air  Force  FY  1993  Financial  Statements,”  December  30,  1994.  This  report 
identified  a  material  weakness  in  the  DFAS  Denver  Center’s  oversight  of  U.S. 
Treasury  clearing  account  balances  and  material  errors  in  amounts  reported  in 
the  Air  Force  financial  statements  for  accounts  receivable  and  accounts  payable. 
Management  concurred  with  all  recommendations  made  in  this  report. 
Recommendations  established  policies  and  procedures  to  monitor  U.S.  Treasury 
clearing  accounts  and  to  improve  the  process  used  to  compile  and  report 
amounts  in  the  financial  statements. 

Report  No.  94-073,  “Defense  Finance  and  Accounting  Service  Work  on  the 
Air  Force  FY  1992  Financial  Statements,”  March  31,  1994.  This  report 
stated  that  the  DFAS  Denver  Center  did  not  prepare  complete,  accurate,  and 
reliable  FY  1992  financial  statements  for  the  Air  Force.  The  report  had  four 
findings. 

o  DFAS  Denver  Center  did  not  comply  with  DoD  accounting 
requirements  or  maintain  effective  procedures  or  controls  for  the  accounting 
systems  used  in  preparing  the  financial  statements.  Causes  cited  for  those 
conditions  included  the  lack  of  a  transaction-driven  general  ledger,  failure  to 
verify  and  reconcile  MAFR  system  outputs  to  field-level  data,  and  premature 
cutoff  dates  for  military  pay.  As  a  result,  the  financial  statements  were 
unreliable. 
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o  Internal  controls  over  budgetary  data  that  the  DFAS  Denver  Center 
used  to  prepare  the  financial  statements  were  not  effective.  The  internal  control 
weaknesses  existed  because  DFAS  Denver  Center  did  not  use  the  DoD  uniform 
chart  of  accounts,  did  not  confirm  transactions  with  field  organizations,  relied 
on  a  budgetary  system  instead  of  the  general  ledger  system,  and  forced  records 
to  agree  with  U.S.  Treasury  balances. 

o  Revenues  on  the  Statement  of  Operations  were  overstated  and 
operating  expenses  were  misstated  because  personnel  did  not  properly  classify 
and  record  revenues,  expenses  and  losses. 

o  The  DFAS  Denver  Center  did  not  validate  the  accuracy  of 
construction-in-progress  data  or  comply  with  Air  Force  guidance  on 
Government-furnished  material  and  contractor-acquired  material.  Those 
conditions  occurred  because  no  procedures  existed  for  verifying  the  validity, 
propriety,  or  accuracy  of  the  amounts  that  DoD  Components  reported  as 
construction-in-progress.  Also,  the  DFAS  Denver  Center’s  internal  guidance 
was  inconsistent  with  DoD  and  Air  Force  regulations  on  reporting  Government- 
furnished  material  and  contractor-acquired  material. 

Recommendations  were  made  to  establish  accounting  systems,  issue  additional 
regulatory  guidance,  ensure  compliance  with  existing  regulations,  enhance 
internal  controls,  and  implement  formal  internal  control  procedures.  DFAS 
nonconcured  with  some  of  the  findings  and  recommendations  concerning  the 
use  of  the  general  ledger  system,  stating  that  the  accounting  data  provided  by 
the  budgetary  system  was  more  accurate  than  the  data  provided  by  the  Air  Force 
general  ledger  system.  Correction  will  occur  with  the  development  and 
implementation  of  DJAS. 


Air  Force  Audit  Agency 


The  AFAA  issued  five  reports  in  which  it  disclaimed  an  opinion  on  the 
Air  Force  Consolidated  Financial  Statements  for  FYs  1992  through  1996. 
AFAA  disclaimed  an  opinion  because  they  could  not  obtain  sufficient  evidence 
or  apply  other  auditing  procedures  required  to  determine  the  fairness  of  the 
information  presented  in  the  financial  statements.  In  support  of  its  opinion 
reports,  the  AFAA  issued  11  other  reports  on  FY  1996  Air  Force  Consolidated 
Financial  Statements,  9  reports  related  to  FY  1995,  5  reports  related  to 
FY  1994,  11  reports  related  to  FY  1993,  and  20  reports  related  to  FY  1992. 
Details  on  the  other  reports  are  provided  in  the  AFAA  opinion  reports,  which 
are  summarized  below. 
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o  Project  No.  96053001,  “Opinion  on  Fiscal  Year  1996  Air  Force 
Consolidated  Financial  Statements,”  March  1,  1997. 

o  Project  No.  95053001,  “Opinion  on  Fiscal  Year  1995  Air  Force 
Consolidated  Financial  Statements,”  March  1,  1996. 

o  Project  No.  945053001,  “Opinion  on  Fiscal  Year  1994  Air  Force 
Consolidated  Financial  Statements,”  March  1,  1995. 

o  Project  No.  94053022,  “Opinion  on  Fiscal  Year  1993  Air  Force 
Consolidated  Financial  Statements,”  June  30,  1994. 

o  Project  No.  92053011,  “Review  of  FY  1992  Air  Force  Consolidated 
Financial  Statements,”  June  29,  1993. 

In  its  disclaimer  on  the  FY  1996  financial  statements,  the  AFAA  stated  that  its 
primary  reason  for  not  rendering  an  opinion  was  that  financial  information  used 
to  compile  the  FY  1996  Air  Force  Consolidated  Financial  Statements  was  not 
reliable,  and  financial  systems  and  processes  and  the  associated  internal  control 
structure  were  not  adequate  to  produce  reliable  financial  information.  The 
AFAA  also  determined  that  several  of  the  conditions  causing  it  to  disclaim  an 
opinion  for  FYs  1992  through  1995  still  existed.  No  recommendations  were 
made  in  the  AFAA  opinion  report  because  they  were  included  in  other  reports. 
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Previously  Reported  Issues 


Of  the  22 IG,  DoD,  audit  recommendations  open  on  or  issued  after 
October  1,  1995,  the  DFAS  Denver  Center  completed  corrective  action  on  10. 
However,  despite  the  progress  made  by  Headquarters,  DFAS,  and  the  DFAS 
Denver  Center,  management  still  faced  significant  challenges  in  responding  to 
the  remaining  12  recommendations,  which  affected  the  compilation  of  data  for 
the  FY  1996  Air  Force  Consolidated  Financial  Statements.  Included  in  those 
issues  were  problems  related  to: 

o  financial  accounting  systems, 

o  U.S.  Treasury  clearing  accounts,  and 

o  the  MAFR  system. 

Although  Headquarters,  DFAS,  and  the  DFAS  Denver  Center  had  begun 
corrective  action  on  all  issues,  the  problems  still  existed  because  most  of  the 
corrective  actions  would  not  be  completed  before  December  1999.  As  a  result, 
we  could  not  adequately  evaluate  the  accuracy  of  data  included  in  the  FY  1996 
Air  Force  Consolidated  Financial  Statements.  Furthermore,  future  financial 
statement  audits  will  be  similarly  affected  as  long  as  the  problems  exist. 


System  Improvements 


Financial  Management  Operations.  DoD  has  emphasized  long-term  efforts  to 
improve  and  standardize  its  financial  management  operations,  but  many  of  the 
benefits  of  those  efforts  will  not  be  realized  for  several  years.  To  correct 
accounting  system  deficiencies  and  reduce  the  number  of  DoD  accounting 
systems,  in  December  1993,  DFAS  established  the  General  Funds  Accounting 
System  Improvement  Plan.*  Under  the  improvement  plan,  in  November  1995, 
the  DFAS  Denver  Center  began  exploring  and  developing  the  General 


‘For  details  of  the  plan,  see  IG,  DoD,  Report  No.  96-180,  “The  General  Fund 
Interim  Migratory  Accounting  Strategy,  June  26,  1996. 
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Ledger/Funds  Control  system.  The  overall  goal  of  the  General  Ledger/Funds 
Control  system  was  to  integrate  the  production  of  complete,  accurate,  and 
timely  financial  statements  and  reports.  Among  other  objectives,  the  General 
Ledger/Funds  Control  system  was  expected  to: 

o  produce  auditable  financial  statements; 

o  provide  for  a  transaction-driven  general  ledger  that  complies  with 
Federal  regulations; 

o  incorporate  the  budget  and  accounting  classification  code;  and 

o  bring  accounting  systems  into  conformance  with  generally  accepted 
accounting  principles. 

In  July  1996,  however,  the  Under  Secretary  of  Defense  (Comptroller)  directed 
DFAS  to  develop  the  Corps  of  Engineers  Financial  Management  System 
(renamed  DJAS)  as  the  General  Funds  accounting  migratory  system  for 
customers  of  the  DFAS  Denver  Center.  That  decision  was  based  on  a  DFAS 
Denver  Center  determination  that  DJAS  presented  a  viable  option  to  satisfy  the 
General  Funds  accounting  requirements  of  the  DFAS  Denver  Center’s 
customers.  DFAS  Denver  Center  management  expects  the  DJAS  to  be 
completed  in  December  1999. 

Audit  Followup.  Through  its  internal  review  function,  the  DFAS  Denver 
Center  monitors  the  status  of  corrective  actions  taken  in  response  to  prior  IG, 
DoD,  and  other  audit  recommendations  and  issues  periodic  status  reports  to 
DFAS.  DFAS  uses  those  reports  to  respond  to  periodic  followup  on  the  status 
of  prior  audit  recommendations  made  by  the  IG,  DoD,  under  DoD  Directive 
7650.3,  “Followup  on  General  Accounting  Office,  DoD  Inspector  General,  and 
Internal  Audit  Reports,”  February  14,  1992.  During  the  followup  process,  the 
DFAS  Denver  Center  reported  to  the  IG,  DoD,  that  corrective  actions  had  not 
been  completed  on  12  prior  audit  recommendations  made  to  fix  problems  with 
accounting  systems  and  other  issues.  As  discussed  below,  these  problems 
affected  our  ability  to  evaluate  the  accuracy  of  data  reported  in  the  FY  1996 
Air  Force  consolidated  financial  statements. 


Financial  Accounting  System  Issues 


Previous  IG,  DoD,  audits  had  identified  the  DFAS  Denver  Center’s  problems 
with  automated  information  systems  used  to  compile  the  Air  Force  financial 
statements.  Those  reports  were  IG,  DoD,  Report  No.  94-073,  “Defense 
Finance  and  Accounting  Service  Work  on  the  Air  Force  FY  1992  Financial 
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Statements,”  March  31,  1994,  and  Report  No.  97-057,  “Compilation  of 
FY  1995  Air  Force  Consolidated  Financial  Statements  at  the  Defense  Finance 
and  Accounting  Service  Denver  Center,”  December  27,  1996  (see  Appendix  B). 
As  discussed  below,  correcting  those  problems  requires  major  changes  to  DFAS 
financial  accounting  systems. 

Transaction-Driven  General  Ledger.  The  DFAS  Denver  Center  did  not  have 
a  double-entry,  transaction-driven  general  ledger  system  for  preparing  the 
Air  Force  consolidated  financial  statements.  Without  such  a  general  ledger,  the 
DFAS  Denver  Center  could  not  prepare  meaningful  financial  statements  that 
met  DoD  accounting  requirements.  Recommendation  A.l.  in  Report  No. 

94-073  recommended  that  the  DFAS  Denver  Center  develop  and  implement  an 
integrated,  double-entry,  transaction-driven,  general  ledger  system  for  preparing 
the  Air  Force  financial  statements.  DFAS  managers  stated  that  the  DJAS 
development  includes  an  integrated,  transaction-driven,  general  ledger  process 
that  will  provide  financial  information  on  the  General  Funds  for  the  Air  Force 
financial  statements.  The  DJAS  is  scheduled  to  be  completed  in 
December  1999.  This  issue  was  first  reported  by  the  GAO  in  FY  1990  in  its 
audit  of  the  FY  1988  Air  Force  consolidated  financial  statements  (Appendix  B), 
and  was  reported  again  in  an  FY  1992  followup  report  by  the  GAO. 

Uniform  Chart  of  Accounts.  The  DFAS  Denver  Center  did  not  use  the  DoD 
Uniform  Chart  of  Accounts,  as  required  by  DoD  7220.9-M,  the  “DoD 
Accounting  Manual,”  October  1983.  This  chart  of  accounts  is  intended  to 
standardize  DoD  accounting  and  meet  basic  reporting  requirements  for  Federal 
financial  statements  and  budgets.  Instead,  the  DFAS  Denver  Center  used  the 
Air  Force  Chart  of  Accounts,  which  did  not  have  the  same  account  structure 
and  could  not  be  reconciled  to  the  DoD  Uniform  Chart  of  Accounts.  The 
DFAS  Denver  Center’s  use  of  the  Air  Force  chart  of  accounts  does  not  allow 
reconciliation  of  budgetary  data  to  proprietary  accounting  data,  which 
contributed  to  the  unreliability  of  the  data  used  in  preparing  the  Air  Force 
financial  statements.  Recommendation  B.l.  in  Report  No.  94-073 
recommended  that  the  DFAS  Denver  Center  implement  the  DoD  Uniform  Chart 
of  Accounts.  According  to  DFAS,  the  DJAS  should  be  capable  of  using  the 
DoD  Uniform  Chart  of  Accounts  when  the  system  is  completed  in 
December  1999. 

Military  Pay  Data.  Military  pay  data  reported  in  the  Air  Force  consolidated 
financial  statements  were  inaccurate  due  to  year-end  timing  differences.  The 
DFAS  Denver  Center  improperly  reported  military  separation  pay  in  the  year 
after  it  was  earned.  Also,  the  Summary  of  Military  Pay  Obligations  system, 
used  to  report  military  pay  activity,  was  cut  off  prematurely  before  the  end  of 
the  fiscal  year.  Thus,  payroll  expenses  that  should  have  been  reported  in  one 
year  were  improperly  reported  the  next  year.  Recommendation  A. 6.  in  Report 
No.  94-073  recommended  that  the  DFAS  Denver  Center  establish  procedures  to 
adjust  for  year-end  separation  pay  and  other  timing  differences.  DFAS  Denver 
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Center  managers  are  working  to  change  the  military  pay  system  to  provide 
estimates  of  the  amounts  attributable  to  the  timing  differences  so  that  accounting 
personnel  can  manually  adjust  the  Air  Force  financial  statements.  The  DFAS 
Denver  Center  also  plans  to  revise  operating  instructions  to  ensure  that  financial 
statements  reflect  the  required  adjustments.  Those  corrective  actions  are 
scheduled  to  be  completed  in  FY  1998. 

Use  of  Budgetary  Data.  We  could  not  verify  accounts  payable  reported  on  the 
Air  Force  Statement  of  Financial  Position  because  the  DFAS  Denver  Center 
used  questionable  budgetary  data  instead  of  general  ledger  data.  The  budgetary 
data  may  have  included  duplicate  amounts.  Recommendation  B.3.  in  Report 
No.  94-073  recommended  that  die  DFAS  Denver  Center  use  general  ledger  data 
instead  of  budgetary  data  to  prepare  the  financial  statements.  DFAS  expects 
this  problem  to  be  corrected  in  December  1999  with  the  completion  of  the 
DJAS. 

Government-Furnished  Material  and  Contractor-Acquired  Material.  In 

preparing  the  Air  Force  Consolidated  Financial  Statements,  the  DFAS  Denver 
Center  did  not  properly  account  for  Government-furnished  material  and 
contractor-acquired  material.  The  DFAS  Denver  Center’s  guidance  on  the 
reporting  of  those  materials  in  the  Air  Force  Consolidated  Financial  Statements 
was  inconsistent  with  DoD  and  Air  Force  regulations.  Recommendation  D.2. 
in  Report  No.  94-073  recommended  that  the  DFAS  Denver  Center  develop  and 
implement  changes  in  internal  guidance  to  conform  to  these  regulations. 
However,  the  DFAS  Denver  Center  does  not  have  a  system  that  can 
differentiate  between  Government-furnished  material  and  contractor-acquired 
material  with  supporting  documentation.  DFAS  expects  this  problem  to  be 
corrected  with  the  implementation  of  DJAS  in  December  1999. 

Fund  Balance  With  Treasury.  DFAS  Denver  Center  personnel  did  not 
reconcile  differences  between  the  U.S.  Treasury  account  balances  and  Air  Force 
base-level  accounts,  as  required  by  OMB  and  DoD  regulations.  OMB  Circular 
No.  A-34,  “Instructions  on  Budget  Execution,”  December  1995,  requires  that 
Fund  Balance  With  Treasury  on  the  financial  statements  be  supported  by  the 
entity’s  accounting  records  and  be  reconciled  to  the  corresponding  accounts 
reported  on  the  U.S.  Treasury’s  end-of-period  balances.  The  “DoD  Accounting 
Manual”  requires  that  amounts  reported  by  the  U.S.  Treasury  be  verified 
against  data  in  the  agency’s  records.  DFAS  Denver  Center  personnel  made 
unsupported  adjustments  to  the  “Report  on  Budget  Execution”  to  force 
agreement  with  the  U.S.  Treasury.  Recommendation  B.4.  in  Report  No. 

94-073  recommended  that  the  DFAS  Denver  Center  reconcile  the  Air  Force 
accounting  records  to  Fund  Balance  With  Treasury  and  limit  adjustments  to 
valid  changes  supported  by  documentation.  DFAS  Denver  Center  personnel 
now  manually  reconcile  their  balances  with  the  U.S.  Treasury  every  month,  and 
all  adjustments,  except  for  undistributed  amounts,  are  supported  by 
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documentation.  DFAS  managers  believe  this  problem  will  be  resolved  with  the 
implementation  of  DJAS  in  December  1999. 

Accuracy  of  Accounts  Payable  Data.  DFAS  Denver  Center  personnel  did  not 
include  $882.3  million  of  negative  Accrued  Expenditures  Unpaid  data  reported 
by  the  DFAS  Columbus  Center  and  its  Albuquerque,  New  Mexico,  office  (now 
closed).  In  addition,  accounting  personnel  did  not  disclose  in  the  financial 
statements  that  unreliable  sources  were  used  in  determining  the  reported 
accounts  payable.  Recommendation  A.l.  in  Report  No.  97-057  recommended 
that  the  DFAS  Denver  Center  coordinate  with  the  DFAS  Columbus  Center  to 
establish  milestones  for  and  monitor  the  progress  in  responding  to  the  system 
change  request  submitted  to  improve  the  reliability  of  the  Mechanization  of 
Contract  Administration  Services  System,  which  is  used  to  compile  and  report 
the  accrued  expenditures  unpaid  on  centrally  administered  contracts.  The  DFAS 
Columbus  Center  expects  to  implement  the  reprogrammed  Accrued 
Expenditures  Unpaid  report  by  FY  1998. 

Audit  Trails.  The  Command  On-Line  Accounting  and  Reporting  System,  a 
major  source  of  data  for  Air  Force  financial  reports,  did  not  provide  adequate 
audit  trails  for  verifying  all  accounting  adjustments  originating  at  the  DFAS 
Denver  Center.  Audit  trails  were  lacking  because  transaction  history  files  were 
not  available  for  use  in  verifying  adjustments  that  accountants  at  the  DFAS 
Denver  Center  had  made  to  the  master  data  files.  Recommendation  B.  in 
Report  No.  97-057  recommended  the  use  of  transaction  history  files  to  establish 
a  complete  and  accurate  audit  trail  of  all  adjustments  made  by  accounting 
personnel  at  the  DFAS  Denver  Center  to  data  reported  through  the  computer 
system.  Because  the  Command  On-Line  Accounting  and  Reporting  System  is  a 
legacy  system,  funding  for  corrections  has  not  been  budgeted.  The  DFAS 
managers  believe  this  problem  will  be  resolved  with  the  implementation  of 
DJAS  in  December  1999. 


U.S.  Treasury  Clearing  Account  Issues 


IG,  DoD,  Report  No.  95-067,  “Defense  Finance  and  Accounting  Service  Work 
on  the  Air  Force  FY  1993  Financial  Statements,”  December  30,  1994, 
identified  two  problems  with  the  monitoring  of  U.S.  Treasury  clearing 
accounts.  As  detailed  below,  the  DFAS  Denver  Center  planned  both  short-  and 
long-term  corrective  actions. 

Reconciliation  of  Clearing  Accounts.  In  preparing  the  Air  Force  consolidated 
financial  statements,  the  DFAS  Denver  Center  did  not  adequately  monitor 
U.S.  Treasury  clearing  accounts  by  reconciling  the  differences  between  those 
account  balances  and  Air  Force  base-level  accounts.  Also,  the  DFAS  Denver 
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Center  did  not  reconcile  one  clearing  account  to  the  U.S.  Treasury  balance. 
Finally,  the  DFAS  Denver  Center  did  not  reconcile  its  own  records  with  those 
maintained  at  base  level  and  by  the  U.S.  Treasury.  Recommendation  A.l.  in 
Report  No.  95-067  recommended  that  the  DFAS  Denver  Center  semiannually 
reconcile  Department  of  the  Air  Force-level  clearing  account  balances,  base- 
level  certified  balances,  and  U.S.  Treasury  balances.  In  response,  the  DFAS 
Denver  Center  manually  reconciled  those  accounts. 

Old  Clearing  Account  Balances.  In  preparing  the  Air  Force  financial 
statements,  the  DFAS  Denver  Center  personnel  did  not  take  sufficient  action  to 
resolve  old  clearing  account  balances  at  the  Defense  accounting  offices.  For 
example,  60  percent  of  the  balance  in  one  clearing  account  represented 
transactions  that  were  6  to  11  months  old,  while  another  20  percent  of  the 
account  balance  represented  transactions  more  than  1  year  old. 

Recommendation  A. 4.  in  Report  No.  95-067  recommended  that  the  DFAS 
Denver  Center  notify  the  Defense  Accounting  Offices  when  clearing  account 
balances  are  more  than  60  days  old  and  require  their  resolution.  To  correct  this 
situation,  the  DFAS  Denver  Center  requested  a  change  to  the  “DoD  Financial 
Management  Regulation”  requiring  the  Defense  Accounting  Offices  to  resolve 
clearing  account  items  within  1  year.  The  DFAS  Denver  Center  expects  this 
change  to  be  made  by  April  1998. 


MAFR  System  Issues 


Problems  related  to  the  MAFR  system’s  internal  controls  over  reconciling 
account  balances  and  maintaining  an  adequate  audit  trail  were  identified  in  IG, 
DoD,  Reports  No.  94-073  and  No.  95-264,  “Defense  Finance  and  Accounting 
Service  Work  on  the  Air  Force  FY  1994  Financial  Statements,”  June  29,  1995. 
As  detailed  below,  the  DFAS  Denver  Center  planned  to  correct  those  problems 
by  April  1998. 

MAFR  System  Reconciliations.  In  preparing  the  FY  1992  Air  Force 
consolidated  financial  statements,  the  DFAS  Denver  Center  did  not  reconcile 
out-of-balance  cash  disbursements  and  receipts  in  the  MAFR  system.  The 
MAFR  system  accounts  for  all  cash  transactions  affecting  the  Air  Force  and 
provides  consolidated  cash  accountability  and  reporting.  Air  Force  Regulation 
177-101,  “General  Finance  and  Accounting  Systems  at  Base  Level,” 

February  15,  1991,  requires  the  DFAS  Denver  Center  to  reconcile  the 
cumulative  dollar  amounts  at  the  department  level  to  the  monthly  MAFR 
packages  submitted  by  each  Air  Force  disbursing  station.  If  an  out-of-balance 
condition  exists,  DFAS  Denver  Center  personnel  are  to  establish  the  source  of 
the  condition,  require  a  reconciliation  of  data,  and  correct  the  out-of-balance 
condition.  Recommendation  A. 4.  in  Report  No.  94-073  recommended  that  the 
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DFAS  Denver  Center  perform  MAFR  system  reconciliations  and  make 
appropriate  corrections.  To  correct  this  situation,  the  DFAS  Denver  Center 
enhanced  the  manual  internal  controls  in  the  MAFR  system  and  requested  a 
system  change  to  automate  those  reconciliations.  The  change  was  expected  to 
be  completed  by  April  1998. 

MAFR  Audit  Trails.  The  MAFR  system,  although  used  in  preparing  the 
FY  1994  Air  Force  financial  statements,  did  not  maintain  an  adequate  audit  trail 
or  transaction  histories  for  transactions  originating  at  the  DFAS  Denver  Center. 
As  a  result,  DFAS  Denver  Center  managers  could  not  identify  all  the 
adjustments  to  the  MAFR  system  database  and,  therefore,  could  not  verify  that 
such  adjustments  were  adequately  supported  or  properly  recorded.  Before  the 
prior  audit  was  completed  in  February  1995,  the  DFAS  Denver  Center  included 
the  requirement  for  audit  trails  in  the  specifications  for  the  Defense  Cash 
Management  System,  which  was  expected  to  replace  the  MAFR  system  in 
January  1998.  Therefore,  Report  No.  95-264  made  no  recommendations  on  this 
matter. 


Summary 


Correcting  prior  audit  issues  is  crucial  to  providing  the  means  for  adequately 
evaluating  the  Air  Force  consolidated  financial  statements  prepared  by  the 
DFAS  Denver  Center.  However,  because  the  DFAS  Denver  Center  had 
initiated  and  was  monitoring  the  status  of  corrective  actions,  we  are  making  no 
further  recommendations. 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Director,  Accounting  Policy 

Director,  Deputy  Chief  Financial  Officer  Support  Division 
Chief,  Internal  Management  Control  Division 
Internal  Control  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Public  Affairs) 

Director,  Defense  Logistics  Studies  Information  Exchange 


Department  of  the  Army 

Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Navy 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 
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Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Finance  and  Accounting  Service 

Director,  Defense  Finance  and  Accounting  Service  Denver  Center 
Internal  Control  Officer 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Inspector  General,  Defense  Intelligence  Agency 


Non-Defense  Federal  Organizations 

Office  of  Management  and  Budget 

Technical  Information  Center,  National  Security  and  International  Affairs  Division, 

General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional  committees 
and  subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 

House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal  Justice, 
Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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Defense  Finance  and  Accounting  Service 
Comments 


DFAS-HQ/AFB 


DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 

1 931  JEFFERSON  DAVIS  HIGHWAY 
ARLINGTON,  VA  22240-5291 


NOV  r  9  1997 


MEMORANDUM  FOR  DIRECTOR,  FINANCE  AND  ACCOUNTING  DIRECTORATE, 
OFFICE  OF  THE  INSPECTOR  GENERAL,  DEPARTMENT 
OF  DEFENSE 

SUBJECT:  Audit  Report  on  Compilation  of  FY  1996  Air  Force 
Consolidated  Financial  Statements  at  the  Defense 
Finance  and  Accounting  Service  Denver  Center  (Project 
No.  6FD-2026) 


We  have  reviewed  the  subject  report  and  our  comments  are 
attached. 

Please  direct  any  questions  concerning  this  matter  to 
Mr.  Charles  McIntosh  on  (703)  607-5105. 


Attachment: 
As  stated 


A.  Harris  / 
Director  for 
'ccounting 
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SUBJECT:  Audit  Report  on  Compilation  of  FY  1996  Air  Force 
Consolidated  Financial  Statements  at  the  Defense 
Finance  and  Accounting  Service  Denver  Center  {Project 
No.  6FD-2026) 


General  Comments.  The  DFAS  has  undertaken  an  effort  to  respond 
to  regulatory  financial  management  compliance  requirements  by 
developing  requirements  for  a  standard  interim  departmental 
accounting  system,  the  Defense  Departmental  Reporting  System 
(DDRS) .  The  DDRS  will  address  streamlining  the  departmental 
fiduciary  reporting  process  and  standardizing  the  departmental 
report  process  to  include  the  Chief  Financial  Officers  Act  report 
requirements.  The  existing  rules  and  tables  used  in  the  CFO 
Reporting  System  will  be  perpetuated  in  the  DDRS  to  accommodate 
DFAS-DE  requirements  and  business  practices.  When  available, 
DFA5-DE  will  begin  using  DDRS  for  preparation  of  departmental 
reports,  including  CFO  statements,  and  the  CFO  Reporting  System 
will  be  replaced.  The  implementation  of  DDRS  will  not  address 
the  material  weaknesses  that  result  from  the  absence  of  a 
transaction-driven  general  ledger  system  at  base-level.  However, 
it  will  eliminate  the  findings  against  the  CFO  Reporting  System 
that  pertain  to  lack  of  systems  documentation,  security,  and 
maintainability.  The  DDRS  should  be  available  for  DFAS-DE  usage 
no  later  than  October  1,  1998. 

Page  3,  second  paragraph.  The  paragraph  is  not  complete. 

The  Air  Force  General  Funds  General  Ledger  is  summarized  by  Air 
Force  base  and  general  ledger  account  code.  However,  in  addition 
to  the  above,  for  CFO  reporting  purposes,  the  data  are 
subsequently  summarized  by  both  operating  account  code  and  at  the 
Air  Force  level. 

Recommendation  1.  We  recommend  that  the  Director,  Directorate  of 
Departmental  Accounting,  Defense  Finance  and  Accounting  Service 
Denver  Center: 

a.  Direct  the  Chief,  Chief  Financial  Officers  Branch, 
Directorate  of  Departmental  Accounting,  to: 

(1)  Document  the  procedures  used  to  manually 
reconcile  the  data  imported  into  the  Chief  Financial  Officers 
Reporting  System  from  the  DD  Form  1176,  "Report  on  Budget 
Execution,"  produced  by  the  Status  of  Funds  system. 

(2)  Periodically  monitor  access  controls  over  the 
Chief  Financial  Officers  Reporting  System  and  provide  annual 
written  reports  on  compliance  with  Recommendations  l.b.(l)  and 
(2)  below. 


Defense  Finance  and  Accounting  Service  Comments 


Management  comments  on  Recommendation  l.a. (1) .  Concur.  The 
automated  and  manual  reconciliation  process  that  ensures  that 
imported  data  agree  with  budgetary  reports  has  been  documented  in 
a  Branch  Operating  Instruction.  Corrective  actions  were 
completed  in  June  1997 . 

Management  comments  on  Recommendation  l.a. (2) .  Concur.  The 
designated  system  administrator  reviews  and  controls  access  to 
the  CFO  Reporting  System.  The  system  administrator  disables 
system  access  when  an  associate*  s  responsibilities  no  longer 
require  system  access.  However,  the  associate1  s  USc.RID  cannot  be 
deleted  if  the  USERID  is  tied  to  a  previous  journal  voucher.  The 
system  administrator  has  been  tasked  to  review  access  to  the  CFO 
Reporting  System  on  an  annual  basis  and  to  provide  feedback  to 
management,  including  usage  of  access  and  screen  saver  passwords. 
Estimated  completion  date  is  June  1998. 

b.  Direct  all  authorized  users  of  the  Chief  Financial 
Officers  Reporting  System  to  establish: 

(1)  Passwords  of  at  least  six  alphanumeric 
characters  for  obtaining  access  to  the  Chief  Financial  Officers 
Reporting  System. 

(2)  Screen  saver  password  controls  in  Microsoft 

Windows . 

Management  comments  on  Recommendation  l.b.l  and  l.b.2.  Concur. 
All  users  of  the  CFO  Reporting  System  have  screen  savers  with 
password  controls  that  prompt  the  users  after  5  minutes.  All 
users  of  the  CFO  Reporting  System  are  required  to  establish 
passwords  that  are  at  least  6  alphanumeric  characters. 

Corrective  actions  were  completed  in  December  1996. 

Recommendation  2.  We  recommend  that  the  Director,  Defense 
Finance  and  Accounting  Service  Denver  Center,  review  and  approve 
future  plans  for  maintaining  the  Chief  Financial  Officers 
Reporting  system. 

Management  comments  on  recommendation  2.  Concur.  Procedures 
have  been  established  for  the  Director,  Defense  Finance  and 
Accounting  Service  Denver  Center,  to  review  and  approve  future 
plans  for  maintaining  the  Chief  Financial  Officers  Reporting 
System.  Corrective  actions  completed  in  October  1997. 


36 


Audit  Team  Members 


This  report  was  prepared  by  the  Finance  and  Accounting  Directorate,  Office 
of  the  Assistant  Inspector  General  for  Auditing,  DoD 

F.  Jay  Lane 
W.  Andy  Cooley 
Sam  R.  Mensch 
Lori  J.  Osterberg 
Susanne  B.  Allen 


INTERNET  DOCUMENT  INFORMATION  FORM 


A .  Report  Title:  Compilation  of  FY  1996  Air  Force  Consolidated  Financial 
Statements  at  the  Defense  Finance  and  Accounting  Service  Denver  Center 

B.  DATE  Report  Downloaded  From  the  Internet:  09/27/99 


C.  Report's  Point  of  Contact:  (Name,  Organization,  Address,  Office 
Symbol,  &  Ph  #):  OAIG-AUD  (ATTN:  AFTS  Audit  Suggestions) 

Inspector  General,  Department  of  Defense 
400  Army  Navy  Drive  (Room  801) 

Arlington,  VA  22202-2884 


D.  Currently  Applicable  Classification  Level:  Unclassified 


E.  Distribution  Statement  A:  Approved  for  Public  Release 


F.  The  foregoing  information  was  compiled  and  provided  by: 
DTIC-OCA,  Initials: _ VM _ Preparation  Date  09/27/99 


The  foregoing  information  should  exactly  correspond  to  the  Title,  Report  Number,  and  the  Date  on 
the  accompanying  report  document.  If  there  are  mismatches,  or  other  questions,  contact  the 
above  OCA  Representative  for  resolution. 


